Ticket History #2240: krb5-config --cflags gssapi when used by OpenSSH-snap-20040212

krb5-1.3.2-beta3:
krb5-config --cflag gssapi
returns -I${includedir} which in my case is -I/krb5/include

But the gssapi.h is in /krb5/include/gssapi
Most gssapi programs use #include <gssapi.h>
So the gssapi.h is not found.

Previous versions of OpenSSH with Simon's modifications
did not use the krb5-config but added -I /krb5/include/gssapi
With openssh-snap-20040212 it now calls krb5-config --cflag gssapi

Possible solutions:

(1) krb5-config --cflag gssapi could return -I/${includedir} -I/${includedir}/gssapi

(2) Programs could use #include <gssapi/gssapi.h>

(3) The gssapi.h could be installed in ${includedir}

(4) Install could do a ln -s gssapi/gssapi.h gssapi.h in the ${includedir}

I suggest (1) as the others could impact other applications or Kerberos implementations.


--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

I would still say if MIT wants people to use the krb5-config
then the gssapi.h should be accessable from the list of include
directories returned by the krb5-config --cflag gssapi

It is not clear where a generic application should find the gssapi.h.
RFC-2744 does not say where the gssapi.h should be, just:
"C-language GSS-API implementations should include a copy of the
following header-file."

Looking at the Heimdal source, Is looks like they install gssapi.h
in the include directory, not a subdirectory of it.

On Solaris, there is a /usr/include/gssapi/gssapi.h

On one of our HPs, there is a link
/usr/include/gssapi.h -> /usr/include/gssapi/gssapi.h






--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

OK, that would work.



--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

Darren Tucker wrote:

The current MIT krb5-config returns only -I/path/to/include

By the time MIT releases a new version of krb5-config, they should have
gssapi.h in the path so the code in question to test for gssapi.h in the
sub directory will not be executed. The Heimdal code (as I understand) does
not have this problem, so does not execute this code.

If they did changed the krb5-config to add some more flags, but did not
fix the gssapi.h not in the path, this code would fail. But I believe that
this is their bug, and they will fix it. This is bug 2240.

This problem is a moving target, my patch was designed to work with past
and future versions of krb5-config.






--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

My argument is that the MIT krb5-config does not do what is expected.

I would also point out that the OpenSSH code already is doing some
strange things with the output which it should not have to to,
namely trying to split the output of krb5-config --libs
into LDFLAGS and LIBS:

2105 K5LDFLAGS="`$KRB5CONF --libs | sed 's/-l@<:@^ @:>@*//g'`"
2106 K5LIBS="`$KRB5CONF --libs | sed 's/-L@<:@^ @:>@*//g'`"

(I saw a fix on the list against this, as it would not allow a -
in a path name. It was trying to delete -L/path/to/heimdal-0.6/lib
but stoped short and left -0.6/lib.)

So the question is then: When will krb5-config be useable? Is it worth
trying to use with OpenSSH in its current state?

The patch I sent would work against the current krb5-config scripts,
including the krb5-1.3.2-beta4.




I also have some other concerns about the krb5-config, as it returns
the final install location of the files. We like to build and install
Kerberos in AFS,along with OpenSSL, and OpenSSH and install them all
as a package on to a local system in a well known location: /krb5/*.
This require the Kerberos and OpenSSL to be installed somewhere not
on the running system while OpenSSH is built.

Without krb5-config, we can easily configure OpenSSH with something like:

...
--prefix=/krb5 \
--with-kerberos5=/afs/anl.gov/appl/krb5-1.3.2/@sys/krb5 \
...

But with krb5-config, it will try to include the /krb5/lib
rather then /afs/anl.gov/appl/krb5-1.3.2/@sys/krb5/lib
So it may try and include the wrong libs from the running system.

krb5-config has the same relocaiton problem as trying to compile in the
-R or -rpath for a shared lib. YOu need the final locaiton in the
shared lib, even if you are installing somewhere else.

(I have a local circumvention for this last point, and we also
provide the -R or -rpath to point at /krb5/lib for OpenSSL,
Kerberos and OpenSSH.)



Sam Hartman wrote:

--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

Jeffrey Altman wrote:

This points out that people want to use the krb5-config
if possible and are willing to bend over backwards to do so.

I also see that the the OpenSSH do a grep gssapi krb5_config
to see if the string gssapi in in the script! Is this a hold
over from some old old version, or differences between MIT
and Heimbal versions of the script?


--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

Sam Hartman via RT wrote:

I don't know? But that what they are doing. and the way thay did it was
to use sed.


--

Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

Install gssapi.h in includedir that includes gssapi/gssapi.h so that
either form of #include will work. Provides better compatibility with
Heimdal.


Commit By: rra


Revision: 18791
Changed Files:
U trunk/src/include/Makefile.in
A trunk/src/include/gssapi.h

pull up r18791 from trunk

r18791@cathode-dark-space: rra | 2006-11-09 17:56:39 -0500
ticket: 2240
Component: krb5-libs
Version_Reported: 1.3.2
Target_Version: 1.6
Tags: pullup

Install gssapi.h in includedir that includes gssapi/gssapi.h so that either
form of #include will work. Provides better compatibility with Heimdal.



Commit By: tlyu



Revision: 18806
Changed Files:
_U branches/krb5-1-6/
U branches/krb5-1-6/src/include/Makefile.in
A branches/krb5-1-6/src/include/gssapi.h